THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-ww6m-cw3f-q94g (medium) — NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

[GHSA] GHSA-ww6m-cw3f-q94g (medium) — NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

medgithub_advisoriesPublished 2026-09-02

GHSA-ww6m-cw3f-q94g Severity: medium CVE: CVE-2026-81722

NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

`nltk.stem.PorterStemmer.stem()` -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in O(n^2) time on a token containing a long run of the letter 'y', letting a single ~20-50 KB token pin a CPU core (CWE-407).

## Root cause

`_is_consonant(word, i

Indicators of compromise

CVE-2026-81722cve

Original source: https://github.com/advisories/GHSA-ww6m-cw3f-q94g